daknetworks.com

Logs for logins are located here:

/var/run/utmp
The current login status.

/var/log/wtmp
The historical login status.

/var/log/btmp
The failed login status.

You can't read these files directly, you have to use the following command: last

So, it would go like this:

last -f /var/run/utmp

Or if you want to see something scary use:

last -f /var/log/btmp